The tl;dr version is: Guess how long it will take and add a bit.

Here comes the science bit … .

Let’s say that we’re asked to work out how long it will take to implement a feature on the project we’re working on. As an expert in the problem domain, we come up with the estimate that it will take 12 hours to complete. That’s just an estimate, so it follows that it will likely take a bit less, or a bit more time. What we have is something akin to a normal distribution of the time it will take to complete the task. Maybe something like this:

The problem is, if you tell your customer that it will take 12 hours to complete, that actually means that there’s a 50% chance you’ll fail to deliver. Yes, you heard me, there’s a 50% chance that you will not be finished when the clock ticks over to 12 hours. That’s because half the area under the graph is to the right of 12 hours.  In the following graph, the probability that you’ll succeed to meet an estimate of 12 hours is shown highlighted in pink:

Don’t set yourself up for failure like this. In this particular graph, the standard deviation of the curve is 1.5, but you will likely have a better feel of how accurate your estimates tend to be and can adjust your working accordingly. Now, in a normal distribution, around 95% of the area under the graph lies to the left of a point two standard deviations to the right of the mean. So, that’s 12 hours + 2 * 1.5 hours = 15 hours.  So, in other words, if you think it will take 12 hours, giving your customer an estimate of 15 hours means you’re about 95% likely to meet, or exceed, that expectation.  The graph becomes:

No-one wants a failure rate of 50%, but 5% … not so bad.

Recently, I’ve ripped WCF out of the heart of a project at work, and replaced it with ServiceStack. There were a couple of reasons for doing this.  Firstly, for the relatively simple API we wanted to expose, the configuration of endpoints and the like in `Web.config` for ServiceStack was overly complex, and also changed from client to client, depending on the base URL of their installation, and whether they ran our app over SSL or not.  It was a maintenance headache, and broke several releases because of mis-configuration.

Secondly, I wasn’t keen on the amount of attributes that had to be dotted around my code to make it work with WCF.  Also, classes in a WCF application often have dozens of methods, one for every service.  The cohesion of these methods if often low, so the classes really break the concept of single responsibility.  I wanted simper, more maintainable code!

ServiceStack has been a breath of fresh air. It prides itself on its simplicity, speed and friction-free development. Once configured in `Web.config`, the configuration is set in stone and doesn’t need to be tweaked.  I can add new web services to the code trivially, and ServiceStack uses reflection at application startup to determine the full set of web methods, and even exposes the metadata nicely at an API documentation page.

There was, however, one major problem.  Our application code relies quite heavily on the ASP.NET session, and in order to support this in a generic handler, the handler has to implement the marker interface `IRequiresSessionState`.

Unfortunately, ServiceStack didn’t do this in its generic handlers which are used to execute our web services. Instead, ServiceStack reimplements a light-weight, efficient Session object.  However, the use of ASP.NET’s own (inferior) session was so baked in to our application that replacing it wasn’t practical.  I had to find a solution.

To get around this limitation, I implemented two new classes, both of which use the decorator pattern to provide us with what we needed.

Firstly, a new IHttpHandler which requires session state. It wraps the IHttpHandler provided by ServiceStack, and passes calls through to it.

    public class SessionHandlerDecorator : IHttpHandler, IRequiresSessionState {
        private IHttpHandler Handler { get; set; }

        internal SessionHandlerDecorator(IHttpHandler handler) {
            this.Handler = handler;
        }

        public bool IsReusable {
            get { return Handler.IsReusable; }
        }

        public void ProcessRequest(HttpContext context) {
            Handler.ProcessRequest(context);
        }
    }

Next, a new `IHttpHandlerFactory` which delegates the responsibility for generating the `IHttpHandler` to ServiceStack, before wrapping the returned handler in our new `SessionHandlerDecorator`…

public class SessionHttpHandlerFactory : IHttpHandlerFactory {
    private readonly static ServiceStackHttpHandlerFactory factory = new ServiceStackHttpHandlerFactory();

    public IHttpHandler GetHandler(HttpContext context, string requestType, string url, string pathTranslated) {
        var handler = factory.GetHandler(context, requestType, url, pathTranslated);
        return handler == null ? null : new SessionHandlerDecorator(handler);
    }

    public void ReleaseHandler(IHttpHandler handler) {
        factory.ReleaseHandler(handler);
    }
}

Then, it’s just a matter of changing the `type` attributes in the handlers in Web.config to `SessionHttpHandlerFactory` instead of `ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack`, and my web services then had the ASP.NET session available to them in `HttpContext.Current.Session`.

The story gained momentum on Wednesday morning on Twitter, and as the image below shows, O2′s Twitter account was being inundated with people complaining about this.

Around lunchtime today, the Guardian published an article about the breach. In the article, it said that a spokesman from the Information Commissioner’s Office said there was no immediate breach of the Data Protection Act, as a mobile phone number on its own is not classed as “personally identifiable information”.

This seemed nonsense to me, so I took a look at the legislation.

1.(1) states that “personal data” means data which relate to a living individual who can be identified -
        (a) from those data, or
        (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller.

I would argue that the phone number is personal data, as O2 can use it in conjunction with their billing records to identify the account holder.

1. (1) also states that “processing” in relation to data includes among other things, “disclosure of the information or data by transmission”.

So, at this point, we can say that O2 have processed personal data by transferring it to websites visited by the user of the phone.  There are of course, many conditions laid out which govern the processing of data.  The first principle (set out in Schedule 1, Part 1, #1) reads:

Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
        (a) at least one of the conditions in Schedule 2 is met, and
        (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is met.

Well, this isn’t sensitive personal data (which is limited to things like religion, political affiliation, sexual preference), so this means that O2 must satisfy at least one of the conditions in Schedule 2 before they can process the data. So, here are the conditions:

1. The data subject has given consent to the processing.
2. The processing is necessary for the performance of a contract to which the data subject is a party, or for entering into such a contract
3. The processing is necessary for compliance with a legal obligation
4. The processing is necessary in order to protect the vital interests of the data subject
5. The processing is necessary for the administration of justice, for the exercise of functions of either House of Parliament, for the exercise of any functions of the Crown, or for the exercise of any other functions of a public nature exercised in the public interest by any person.

So, a quick glance will tell you that O2 can only process this data if explicit permission has been given by the subject for them to do so.

Now, when signing up for a contract, you have to agree to the Privacy Policy of O2.  Section 5 is entitled “Disclosure of your Information” and guess what… it doesn’t say that it will disclose it to every Tom, Dick or Harry who runs a website.  So, by agreeing to their terms and conditions, data subjects do not consent for their information to be used in this way.

I’d argue that this means that O2 are in breach of the Data Protection Act.  Case closed, although I’m no lawyer….

If you want to see whether you’re affected, Lewis has written a quick web page which will tell you if it’s being sent your phone number.  Visit it at http://lew.io/headers.php.

Update 25-Jan-2012 15:39

Since writing earlier today, O2 have issued an explanation of what went wrong on their blog. In it, they say that the problem has been occurring since 10th January owing to a bug. The reason it’s even possible is that this data is designed to be sent to trusted third parties for purposes of age verification etc. (and this is permitted by their privacy policy). However, given that the data doesn’t go over WiFi, then the trusted 3rd parties are only getting the information in certain cases, which makes it hard to understand how this could work for them.

The good news is that the data breach is now fixed, and O2 are co-operating with the Information Commissioner’s Office and have notified OFCOM. Full marks to O2 on the transparent way they’ve handled this.

The wording of the proposed SOPA legislation means that a huge number of websites can be classed as “facilitating the commission of copyright infringement”.  For example:

• A blog which allows users to post comments
• An e-commerce site which allows shoppers to leave reviews
• Any other site which allows Internet users to upload content which could include copyrighted material

But, I’m not subject to US jurisdiction… there’s nothing they can do, right?

Wrong!

If your site is classed as facilitating the commission of copyright infringement, the proposed legislation will allow the US government to force:

• ISPs to block access to your site in the USA (section 102(c)(2)(A)(i)) – no big deal for a UK-based small business I agree
• Search engines (e.g. Google) to remove you from their listings (section 102(c)(2)(B) – hmm, that’s going to cause a problem
• Ad providers (e.g. Google AdSense) from serving ads to your site – that could hurt my pocket a bit
• Payment providers (e.g. PayPal) to terminate service to your site – ouch, I can’t sell anything!

You can appeal against being cut off like this and can be granted a stay of execution, but only if you subject yourself to the jurisdiction of the US courts, and if you know about the action against you (and the legislation does not even require that you’re notified!)

This is a really big deal for users of the Internet across the whole world.  Even if you’re a small cottage industry selling arts and crafts to UK citizens from a site hosted in the UK with a .co.uk web address, the chances are that a lot of your visitors will be referred by Google, and that you’ll use a US based payment provider such as PayPal.  The US government would therefore be able to effectively shut down your website.

Don’t allow this to happen.  As non-Americans, we have no congressman to lobby, but you can sign up to this petition to the US state department.

Oppose SOPA.

The current text of the proposed SOPA bill can be viewed in its entirity here. My information above is all taken from section 102.

No one wants to die. Even people who want to go to heaven don’t want to die to get there. And yet death is the destination we all share. No one has ever escaped it. And that is as it should be, because death is very likely the single best invention of life. It is life’s change agent. It clears out the old to make way for the new. Right now the new is you, but someday not too long from now, you will gradually become the old and be cleared away. Sorry to be so dramatic, but it is quite true.

Your time is limited, so don’t waste it living someone else’s life. Don’t be trapped by dogma — which is living with the results of other people’s thinking. Don’t let the noise of others’ opinions drown out your own inner voice. And most important, have the courage to follow your heart and intuition. They somehow already know what you truly want to become. Everything else is secondary.

Steve Jobs, 2005

Rest in peace.

I’ve used may different products: NuGet, Orchard, log4net, Cassandra, ELMAH, Glimpse, Ninject, Castle Windsor, jQuery, Modernizr, WordPress, Rhino Mocks. I could probably easily go on and list a hundred or so, but that’s not the point really.

At last, I’ve done it. Last week, I submitted a pull request to the NuGet Docs project on CodePlex. It wasn’t a big change, it wasn’t even “real” code, just some fixes to the installation instructions for setting up a local copy of the NuGet gallery. It was accepted.

I’ve now started one very small step down the road to giving back. I intend to do lots more. If you use open source products, and you have the skills to contribute, I strongly urge you to do so. Thanks.

I was expecting quite a battle to get .Net 4 installed, configured, and working on the server.  My fears were unfounded.  I ran the installer, rebooted, created a virtual directory, set it to ASP.NET version 4.0 (which required an IIS restart, more on this later), published the default “Welcome to ASP.NET” application, and voila!  The result of a HEAD HTTP request to the new virtual directory (note the Server and X-AspNet-Version headers):

The website in action:

It was almost too easy.

So, while I was on a roll, I decided to have a quick play around to find out if it would be easy enough to deploy MVC3 applications to the server.  Unfortunately, it wasn’t quite so easy.  I created another virtual directory and set it to .Net 4.  I was surprised that the system prompted me to restart IIS again – I had assumed that this happened before because it was the first app I’d set to version 4.0.  The prompt gives a hint about running aspnet_regiis –norestart –s <VirtualPath>, but in this case, I didn’t know what the virtual path was.

After a little research, I found out that running aspnet_regiis –lk lists the virtual directories on the server, and this is key to getting hold of the magic number that corresponds to the website.  So, with that info, I was able to run:

aspnet_regiis –norestart –s W3SVC/116872853/root/net4mvctest/

which updated my app to .Net 4 without needing an IIS restart.  Note that your virtual directory path will differ from the above!

MVC3 is not installed on the server, and I had no real wish to install it.  To ensure that my app ran on the server, in Visual Studio I selected the menu item “Project –> Add Deployable Dependences…” and ticked “ASP.NET MVC” and “ASP.NET Web Pages with Razor syntax”.  Now, I deployed.  The result… “Directory Listing Denied”.  Hmmmm.

It turns out that when you deploy a .Net 4 app inside a .Net 2 website, you need to setup a wildcard extension so that .Net handles all requests to the application.  On the application’s property pages in IIS Manager, I clicked “Configure” and inserted a new wildcard map to point to C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll and ensured that “Verify that file exists” was unticked.  Ah, that’s better…

All in all, it took me less than an hour to set all this up, including working through my problems.  I’d say that was a good hour’s work.  Now, I need to get on with configuring and deploying the NuGet gallery…

When I first heard about Google+, I couldn’t wait to take a look – the [demo videos][2] I saw on the Google Blog were incredibly slick, but didn’t really seem to give too much away. It’s only this last weekend, that I finally got an invite to the site and got started.

### First impressions

As I gleaned from the launch videos, the site is slick, uncluttered and well designed. Google have really given this some thought; the site looks modern and fresh. There is a nicely laid out help section, but it’s not easy to find. If you hunt hard enough, you’ll find it underneath the cog symbol on the Google+ Bar (their menu bar across the top of the page).

Now I’ve used Google+, the recent restyling of the web search result page makes total sense. It’s to give better visual integration between the different Google products. In the last day or two, they’ve also rebranded the calendar to match.

Another big win… I don’t get disturbed by countless requests to become a farmer, or manage a city, or answer inane personal questions about my friends.

### Integration

Integration with other Google products is a huge plus for Google+. I often sit with [Gmail][3] open in my browser all day. I also have my social media open… the [Facebook][10] web page and [MetroTwit][4], my current [Twitter][11] client of choice.

With Google though, everything is in once place. The new Google+ bar appears across the top of GMail, [Google Docs][8] and [Picasa Web Albums][7]. It has a number of features including a prominent notification icon to indicate when there’s something interesting I might want to look at, and even the functionality to share something with my Google+ contacts right from the menu bar. These functions are missing from the Google+ bar on the [calendar][9] for some reason though.

This is a huge plus point for me… having everything available from one portal to keep my PC decluttered.

Albums and photos from Picasa can be easily shared to your Google+ account. This integration alone is probably enough to stop me using [Flickr][5] and switch to Picasa instead.

### Privacy and Security

Everything’s in SSL! OK, so Facebook have started offering this, but it’s an opt-in thing that (I suspect) the vast majority of users don’t switch on. In fact, Facebook’s version is quite annoying, as any applications on your homepage that don’t support SSL result in a certificate warning in your browser for insecure content.

Google+ brings **circles** to the table for controlling who sees your post. In [his review][6], [@martinfowler](http://twitter.com/martinfowler “Martin Fowler – Twitter”) suggests that Circles are something new that neither Facebook nor Twitter offers. I’m not sure I agree. Facebook allows adding your friends to lists, and everything you post can be restricted to a set of people or lists by clicking the padlock icon immediately to the left of the “Share” button. However, I think one crucial difference is that Google+ pushes this choice in your face, and part of publishing an update is explicitly choosing which circles to make the post available to. With Facebook, this seems like an afterthought, and hence the mast majority of Facebook posts are visible to all friends (even the dodgy bloke you went to school with decades ago and has probably been in and out of prison a few times since). Google+ offers you a default set of circles to start with: Family, Friends, Acquaintances and Following. You can add a contact to more than one circle, and you can share a post with any number of circles.

The security model is so feature-rich, that I can even choose to share part of my profile only with selected circles. This is something Facebook doesn’t have. For example, Google+ gives me the option to share my employment history with all of my circles, but my places lived with just Friends and Family. Facebook gives me limited options like Everyone, Friends of Friends, Friends and Just Me.

If you’re tagged in album, that tag doesn’t automatically get made public – you have to approve it first. If someone tags a picture of you throwing up after too much drink, that’s not instantly going to be made public to all of your contacts. You can edit your profile to allow tags made by certain circles to be automatically approved if you’d like (I don’t think Aunty Mable will be tagging any defamotary images of me for example).

When viewing my profile, there’s a big option right at the top of the page to let me view the profile as it appears to another user. This is great. Check regularly to ensure that nothing sensitive is being “leaked out”. Yes, I know Facebook offers this, but it’s hidden deep inside the settings somewhere, and if I recall correctly they keep moving it (making it pretty hard to find at times!)

Fed up of Google+? You can download all of your data and delete your account. It’s not hidden… just go to “Account Settings -> Data liberation” to get at your data… photos, profile data, stream data, circles and contacts, you name it. At the time of writing, Facebook have a lot of catching up to do in this respect, that’s for sure!

### Your Friend Doesn’t Use Google+? No Problem

You can add contacts to your circles even if they’re not Google+ users (as long as they have an email address). When you post an upate, you can tick a box to send an email of the update to your non-Google+ friends. This is innovative, but if I was the recipient, I’m not sure how much I’d appreciate getting updates from someone if I wasn’t an avid social network user?

### What Else Is There

##### Hangout

Hangout is a live multi-person video chat. Signing in to Hangout is like saying, “Hey, I’m hanging out, come and chat with me”. I haven’t used it yet (I don’t have enough friends on the service), but it looks fantastic. This, I have not seen anywhere else apart from the paid edition of [Skype][12].

##### Instant Upload

I’m not sure whether I think this is a good idea, or whether it violates my privacy a _little_ too much. I can’t use it as it’s ony available on the Android mobile app for now (and I’m an iPhone user). You can set your phone to automatically upload every photo you take to a private web album. Then, from anywhere, you can choose to share some of these photos with your contacts.

I wonder whether this will be possible on the iPhone version of the application. I suppose it all depends on what hooks are available in the iOS operating system, but I suspect this may not be possible on the platform.

##### Sparks

At the moment, I don’t know whether this is a gimmick or something I’ll find useful. Basically, you store a list of Google search terms, and they appear in your left hand menu. Click on them, and you’ll be presented with a list of hits published recently on the web. Each of the results can then easily be shared with your contacts (using the usual method where you specify which circles etc. receive the notification).

Personally, I’d love it if I could subscribe to RSS Feeds in Sparks… now _that_ would be useful.

##### Huddle

This is supposed to be some kind of group chat, I think. At least, that’s what I worked out from the marketing video. I can’t tell you any more as I can’t find it on my account. Maybe it’s not live yet…? Maybe it’s suppressed in the UK, as there’s a [trademark dispute][13] going on with a London startup over the name.

### What’s Missing – Channels

I can’t take any credit for this idea. I was reading a [blog post][14] by [@davidebbo](http://twitter.com/davidebbo “David Ebbo – Twitter”), and I just thought that what he had to say was a fantastic idea. David promotes the idea of channels…

If I write about personal things and also work techy things, I could configure my account to have two channels. When I post something, I can optionally choose to publish it to one of my channels. When one of my contacts adds me to a circle, they can just choose to add a subset of my channels. For example, most people in my family would only choose the “Personal” channel, so they wouldn’t see loads of posts about software development that they’re not interested in at all.

Currently, I mostly use Twitter for technical stuff, and Facebook for personal things. It would be great to have one service that I could post everything to, but allowing my followers to filter what they see of me. +1 for this idea Mr Ebbo! If this were implemented, I think it might be the single most compelling reason to jump ship and use Google+ (apart from the fact that very few people are on there yet)!

### Summary

Google+ can survive, and I _really_ hope that it does. They have some compelling features that beat Facebook hands down. Google has a billion users using its search… the question is, can Google convert these search users into Google+ users? Google+’s future depends on it.

[1]: http://plus.google.com/ “Google+”
[2]: http://googleblog.blogspot.com/2011/06/introducing-google-project-real-life.html “Google+ Launch Announcement”
[3]: https://mail.google.com/ “Gmail – Google’s email offering”
[4]: http://www.metrotwit.com/ “MetroTwit Twitter client”
[5]: http://flickr.com “Flickr”
[6]: http://martinfowler.com/bliki/SocialNetworks.html “SocialNetworks – Martin Fowler”
[7]: http://picasaweb.google.com/ “Picasa Web”
[8]: http://docs.google.com/ “Google Docs”
[9]: http://www.google.com/calendar/ “Google Calendar”
[10]: http://www.facebook.com/ “Facebook”
[11]: http://twitter.com/ “Twitter”
[12]: http://www.skype.com/ “Skype”
[13]: http://gigaom.com/2011/07/05/huddle-google/ “UK startup defends Huddle name against Google – again”
[14]: http://blog.davidebbo.com/2011/07/one-big-feature-social-networks-really.html “One big feature social networks really need: Channels – David Ebbo”

• Adobe Reader and Acrobat Manager
• Google Chrome
• GrooveMonitor Utility
• iTunesHelper
• Java Update Scheduler
• Microsoft Office Excel
• Microsoft Security Client User Interface
• Steam
• Synaptics ToughPad Enhancements
• TortoiseHgOverlayServer.exe
• Windows Explorer
• Windows host process (Rundll32)
• Windows Live Messenger

How come Chrome can update itself without me having to close EVERYTHING I am doing?!

Many walkthroughs mention using a file named hgwebdir.cgi, but as of Mercurial 1.6, this no longer exists. Some walkthroughs mention copying the contents of a library.zip file into the website, or placing .dll files in there too. Nothing like this worked for me, and it seemed ridiculously complex.

Today, I’ve made a concerted effort to get things working, and guess what? It’s REALLY EASY!

Before you start though, you should consider whether you really want to do this. Take a look at BitBucket which is a hosting site for Mercurial. It’s ran by Atlassian and is completely free for up to five developers. If hosting your source code externally is not politically viable, you want more control over your repos, or you don’t want to pay for BitBucket when scaling up beyond five users, then by all means follow the below instructions.

OK, what do you need?

• A Windows server, with IIS6 or IIS7 setup, including the facility to use CGI scripts.
• Python 2.6.6 (available from http://www.python.org/download/releases/2.6.6)
• Mercurial 1.8.2 Python 2.6 package – x86 Windows (available from http://mercurial.selenic.com/downloads/)
• The Mercurial source release (also available from http://mercurial.selenic.com/downloads/)

And that’s it.

Note that the version numbers of Python must match. I dare say that future versions of the Mercurial Python package may specify version 2.7 of Python… if that’s the case, just get Python 2.7.x instead.

So, the steps to carry out on the server were pretty simple:

1. Install Python

2. Install the Mercurial Python package

3. Create a new web application in IIS.

4. From the Mercurial source release, copy the file hgweb.cgi to your web application, and rename it index.py. You don’t have to rename it, but I just think the extension .py accurately reflects that this is a Python script, and as it’s going to be the default document of the website, “index” seems a good name for it.

5. Create a subfolder called Repositories underneath your web application. This will be used to host your repositories.

6. Create a new file called hgweb.config in your web application’s folder. It’s contents should be something like this:

[collections]
C:\PATH_TO_YOUR_WEB_APP\Repositories = C:\PATH_TO_YOUR_WEB_APP\Repositories

7. Edit index.py so that the line which starts config = “some path” contains the full path to your hgweb.config file, i.e.:

config = “C:\PATH_TO_YOUR_WEB_APP\hgweb.config”

8. Configure IIS as follows:

You’ll need to set the default document for your application to index.py.

You’ll need to enable Basic Authentication for the web application and disable all other forms of authentication. Set the default domain to be the domain of your server, so that users don’t need to qualify their usernames with the domain when logging on.

In IIS7 you’ll need to use Add Script Map… (under Hander Mappings) to map *.py requests to C:\Python26\python.exe %s %s.

In IIS6, this is available by clicking “Configuration” on the Directory tab then adding a mapping so that “C:\Python26\python.exe” %s %s (note the quotes around the executable this time) is used to handle the extension py. Also in IIS6, you’ll need to ensure that you have a web service extension for Python which is allowed and has the filename c:\Python26\python.exe %s %s.

9. Create a test repository in your Repositories folder.

10. Configure the test repository by editing its .hg\hgrc file to include:

[web]
allow_push = * # alternatively, a comma separated list of users with push privileges
allow_archive = zip # this allows users to download a .zip archive of the source code
push_ssl = false # this allows pushing over HTTP. You’re advised to setup SSL though, and then remove this line

11. On your client machine, test out the new repo by executing the following (the program will prompt you for your credentials which is just your domain account):

hg clone http://YOUR_SERVER/YOUR_APP_NAME/index.py/YOUR_REPO_NAME your_local_folder

12. Make some changes, check them in and push back to the repository.

13. Browse the repository in a web browser at http://YOUR_SERVER/YOUR_APP_NAME/

Exercises for the interested reader:

1. Setup URL rewriting so that the “index.py” part of your path is invisible.

2. Add a self-signed SSL certificate to your server, and get Mercurial to work with this (hint: Google for the hostfingerprints directive of Mercurial.ini).

3. Enable public read-only access to your repo, but require a login to push changes (I’ve not figured this out myself yet, so please comment if you work it out!)